Method for determining information on an integrity of signal processing components within a signal path, signal processing circuit and electric control unit

ABSTRACT

A method for determining information on an integrity of signal processing components within a signal path includes adding an alive signal to a signal at a first position within the signal path and detecting an added alive signal corresponding to the alive signal at a second position within the signal path. Further, the method includes determining the information on the integrity based on the detected signal.

RELATED APPLICATION

This application claims priority under 35 U.S.C. § 119 to German PatentApplication No. 102017103418.8, filed on Feb. 20, 2017, the contents ofwhich are incorporated by reference herein in their entirety.

TECHNICAL FIELD

Examples relate to a method for determining information on an integrityof at least one signal processing component within a signal path, asignal processing circuit having a signal path for processing a sensorsignal and an Electric Control Unit for receiving signals from a signalprocessing circuit.

BACKGROUND

Monitoring of signal processing components within signal paths is oftendesirable in order to conclude on an integrity of the signal processingcomponents within the signal path or a specific part thereof. Monitoringof signal processing components within signal paths may allow toconclude, whether the signal processing components operate as desiredand whether a signal output by the signal path can be relied on. Oneparticular interest may be to be able to identify, whether a signalprocessing component still operates or whether it is eventually stuck,providing one and the same output independently from varying signalsinput into the signal processing component in question. This may, forexample, be of interest if a system relies on sensor signals generatedby sensors and subsequently processed within the signal path in order totrigger safety measures. For example, in automobiles, a wheel speedsensor device provides information on a rotational velocity of a wheel,which is received by an electronic control unit (ECU) in order to allowto conclude on safe driving conditions of the vehicle. In otherexamples, linear hall sensors provide an output signal proportional tothe strength of a magnetic field at the sensor position or angularsensors provide an output indicating an angle of an observed object withrespect to a reference. In typical sensor devices, the signal providedby the sensor is subsequently processed by some signal processingcomponents of a signal path within the sensor device before theinformation on the observed quantity (e.g. a rotational speed or anangle) is transmitted to the ECU to be processed further. In the eventof an error within the signal path within the sensor device or a part ofthe signal path constituted by the interface between the sensor deviceand the ECU, wrong information may be received and the safety of thepassengers of the car may be at risk. Hence, there is a desire todetermine information on the integrity of signal processing componentswithin the signal path.

SUMMARY

An embodiment relates to a method for determining information on anintegrity of at least one signal processing component within a signalpath which comprises adding an alive signal to a signal at a firstposition within the signal path. The method further comprises detectinga signal corresponding to the alive signal at a second position withinthe signal path and determining the information on the integrity basedon the detected signal. By observing the signal corresponding to thealive signal, one may be able to conclude whether the signal processingcomponents between the first position and the second position operatereliably if further deliberate alterations of the alive signal betweenthe two positions are known a priori or if no further alterations areexpected. If the so determined expected alive signal is in factdetected, one may conclude that the signal processing components betweenthe two positions operate without error and that integrity of thosesignal processing components can be assumed.

According to another embodiment, a signal processing circuit having asignal path for processing a sensor signal comprises an alive signalgenerator configured to add an alive signal to the sensor signal at afirst position within the signal path. Using an embodiment of a signalprocessing circuit may allow other signal processing components withinthe signal processing circuit or further processing elements receivingdata of from the signal processing circuit to check, whether some or allof the signal processing components within the signal processing circuitoperate reliably.

According to a further embodiment, an Electric Control Unit forreceiving signals from a signal processing circuit comprises anintegrity determination circuit configured to receive an added alivesignal and to determine an integrity of at least one signal processingcomponent within the signal processing circuit based on a comparison ofthe added alive signal and an expected alive signal. Using an embodimentof an Electric Control Unit may allow concluding on the reliability ofoperation of one or more signal processing components within the signalprocessing circuit as well as on the reliability of an interface betweenthe Electric Control Unit and the signal processing circuit.

BRIEF DESCRIPTION OF THE DRAWINGS

Some examples of apparatuses and/or methods will be described in thefollowing by way of example only, and with reference to the accompanyingfigures, in which

FIG. 1 illustrates an example of a signal processing circuit having asignal path allowing to add an alive signal to a signal within thesignal path;

FIG. 2 illustrates a further example of a signal processing circuithaving a signal path allowing to add an alive signal upon a request of aECU;

FIG. 3 illustrates a flow chart of a method for determining informationon an integrity of signal processing components within a signal path;

FIG. 4 illustrates a block diagram illustrating a first example foradding an alive signal;

FIG. 5 illustrates a block diagram illustrating a second example foradding an alive signal;

FIG. 6 illustrates a block diagram illustrating a third example foradding an alive signal;

FIG. 7 illustrates a block diagram illustrating an example for adding analive signal in response to a trigger of a ECU;

FIG. 8 illustrates a block diagram illustrating an example for adding analive signal provided by a ECU; and

FIG. 9 illustrates examples for adding an alive signal to a PWM Signalused to transmit a Sensor readout.

DETAILED DESCRIPTION

Various examples will now be described more fully with reference to theaccompanying drawings in which some examples are illustrated. In thefigures, the thicknesses of lines, layers and/or regions may beexaggerated for clarity.

Accordingly, while further examples are capable of various modificationsand alternative forms, some particular examples thereof are shown in thefigures and will subsequently be described in detail. However, thisdetailed description does not limit further examples to the particularforms described. Further examples may cover all modifications,equivalents, and alternatives falling within the scope of thedisclosure. Like numbers refer to like or similar elements throughoutthe description of the figures, which may be implemented identically orin modified form when compared to one another while providing for thesame or a similar functionality.

It will be understood that when an element is referred to as being“connected” or “coupled” to another element, the elements may bedirectly connected or coupled or via one or more intervening elements.If two elements A and B are combined using an “or”, this is to beunderstood to disclose all possible combinations, i.e. only A, only B aswell as A and B. An alternative wording for the same combinations is “atleast one of A and B”. The same applies for combinations of more than 2elements.

The terminology used herein for the purpose of describing particularexamples is not intended to be limiting for further examples. Whenever asingular form such as “a,” “an” and “the” is used and using only asingle element is neither explicitly or implicitly defined as beingmandatory, further examples may also use plural elements to implementthe same functionality. Likewise, when a functionality is subsequentlydescribed as being implemented using multiple elements, further examplesmay implement the same functionality using a single element orprocessing entity. It will be further understood that the terms“comprises,” “comprising,” “includes” and/or “including,” when used,specify the presence of the stated features, integers, steps,operations, processes, acts, elements and/or components, but do notpreclude the presence or addition of one or more other features,integers, steps, operations, processes, acts, elements, componentsand/or any group thereof.

Unless otherwise defined, all terms (including technical and scientificterms) are used herein in their ordinary meaning of the art to which theexamples belong.

FIG. 1 illustrates a signal processing circuit 100 having a signal path110 for processing sensor signals. The signal processing circuit 100further comprises an alive signal generator 120 configured to add analive signal to a signal at a first position 130 within the signal path110. The signal processing components within the signal path 110comprise a signal source 112 to initially generate a signal and a signalprocessing element 114 to further process the signal. Further, thesignal path 110 comprises a protocol encoder 116 used to format datagenerated by the signal processing element 114 to comply with a dataprotocol chosen for a signal interface 150. The signal processingcircuit 100 transmits data to the Electric Control Unit 200 via signalinterface 150.

Further, FIG. 1 schematically illustrates an Electric Control Unit (ECU)200 for receiving signals from the signal processing circuit 100. TheECU 200 comprises an integrity determination circuit 210 configured toreceive the added alive signal and to determine an integrity of at leastone signal processing component within the signal path 110 based on acomparison of the added alive signal received and an expected alivesignal. Depending on the first position 130 with respect to a secondposition 220 of the integrity determination circuit 210, examples may becapable of determining information on an integrity of one or more signalprocessing components within the signal path 110.

While the ECU 200 and the signal processing circuit 100 may be twodifferent hardware entities connected via the signal interface 150, thefollowing explanation of some aspects of the embodiments describedherein will jointly describe the functionality of the signal processingcircuit 100 and the ECU 200 to appropriately describe the interactionbetween, for example, the alive signal generator 120 and the integritydetermination circuit 210, being also illustrated by means of a flowchart in FIG. 3.

As illustrated in the flowchart of FIG. 3, some embodiments add an alivesignal to a signal at a first position 130 within the signal path 110and detect a signal that corresponds to the alive signal at the secondposition 220 within the signal path 110. In the exemplary embodimentillustrated in FIG. 1, the first position 130 is within the signalprocessing circuit 100 while the second position 220 is within the ECU200. That is, the signal path 110 to be monitored extends over twoentities, the signal processing circuit 100 and the ECU 200. Aselaborated on in the following paragraphs, the information on theintegrity of signal processing components within the signal path 110 isdetermined based on an added alive signal which is received by theintegrity determination circuit 210. In case of error free operation,the added alive signal corresponds to the alive signal, e.g. it dependson the alive signal according to a predetermined relationship or it maybe equal to the alive signal, depending on the circumstances. An examplefor the information on the integrity of signal processing componentswhich is derived is that all signal processing components operatewithout error. However, the information on the integrity of signalprocessing components derived according to further embodiments may alsoinclude more details, such as for example an information, how many ofthe signal processing components within the signal path operate withouterror and how many do not.

Further embodiments may provide information about the operational status(e.g. erroneous or not erroneous) of each signal processing componentwithin the signal path. Generally, the information on the integrity ofsignal processing components within the signal path may be any kind ofinformation allowing to conclude, whether signals or data are processedwithout error along the signal path 110 or within parts thereof. Furtherembodiments may provide statistical information as the information onthe integrity of signal processing components, as for example aprobability estimate for all signal processing components workingwithout error.

In the embodiment illustrated in FIG. 1, the signal processed within thesignal path 110 is generated within the signal path 110 itself by meansof the signal source 112. The signal source itself can be any means togenerate a signal, be it digital or analog and the signal may begenerated in an arbitrary digital or analog representation. For example,the signal source 112 may be a sensor for sensing a physical quantitythat outputs an analog or a digital signal which is related to thesensed physical quantity. In the exemplary signal path 110, a signalprocessing element 114 receives the signal generated by the signalsource 112 and processes it further before the processed signal istransferred to the protocol encoder 116 to transfer it to the ECU 200via the interface 150. An example of a signal processing element 114 maybe an analog-to-digital converter to convert an analog signal providedby a sensor acting as signal source 112. According to the embodimentillustrated in FIG. 1, the alive signal generator 120 adds (embeds) analive signal to the signal generated by means of the signal source 112and at a first position 130 at the very beginning of the signal path110. Some alternatives as to how an alive signal may be added to asignal within a signal path 110 are subsequently discussed withinrespect to FIGS. 4 to 9.

Adding an alive signal to the signal within the signal path 110 resultsin the alive signal being represented within the signal processed withinthe signal path 110 by some means, while the technical details of theadding or insertion (embedding) of the alive signal depend on theparticular implementation.

The integrity determination circuit 210 receives the added alive signal.When the added alive signal corresponds to or is equal to an expectedalive signal, the integrity determination circuit 210 may conclude thatthe signal processing components within the signal path 110 operatewithout an error so that integrity of the signal path can be assumed.The expected alive signal is a signal that can be determined from apriori knowledge of the functionality of the individual signalprocessing components within the signal path 110 between the firstposition 130 and the second position 220. The expected alive signal canbe computed from the alive signal assuming an error-free operation ofall signal processing components within the signal path 110. In otherwords, the integrity determination circuit 210 is configured todetermine the expected alive signal using the alive signal and anexpected signal processing algorithm to compute the expected alivesignal. According to one embodiment, for example, the alive signal maysimply be forwarded by every signal processing component within thesignal path 110 so that the receipt of the added alive signal itself(being the expected alive signal) at the second position 220 by means ofthe integrity determination circuit 210 allows to conclude that allsignal processing components within the signal path 110 operate withouterror.

An embodiment as disclosed in FIG. 1 may, for example, allow to alsodetect malfunctions where one signal processing element within thesignal path 110 is stuck. Being stuck, a signal processing component maystill output a valid output signal. However, internal updatingmechanisms may be out of order so that the signal output by the signalprocessing component in error remains constant rather than beingupdated. When being stuck, the alive signal would not be forwarded oroutput by the signal processing component being stuck and, hence, alsosuch type of error can be detected by the embodiments described herein.

Depending on the particular implementation, the alive signal may be asignal that is added only once to a signal within the signal path or thealive signal may comprise a series of individual subsignals subsequentlyadded, the series being known to the integrity determination circuit.If, for example, the interface 150 between the signal processing circuit100 and the ECU 200 is a unidirectional interface, the alive signal maybe a signal sequence of known subsignals in order to be able todetermine, whether an individual signal processing component within thesignal path is stuck. If, however, the interface between the ECU 200 andthe signal processing circuit 100 is bidirectional, as illustrated inFIG. 2, an alive signal may only be transmitted a single time uponreception of a trigger signal (trigger pulse) sent from the ECU 200 tothe alive signal generator 120.

Some embodiments of signal processing circuits 100 comprise an alivesignal generator 120 that comprises a signal input 122 configured toreceive such a trigger signal. The alive signal generator 120 is thenconfigured to add the alive signal in response to the receipt of thetrigger signal. Once the integrity determination circuit 210 knows whento expect the receipt of the alive signal, a single transmission of analive signal may be sufficient to conclude on an integrity of the signalpath 110 due to the correlation of the sending of the trigger signal andthe receipt of the added alive signal.

The trigger signal may be an arbitrary signal causing the signalprocessing circuit to submit an alive signal which may be known inadvance. According to further embodiments, however, the bidirectionalinterface may also be used to transmit the alive signal from the ECU 200to the signal processing circuit 100 so as to be able to generate thealive signal to be used within the signal processing circuit 100 at theECU 200. To this end, the ECU 200 may comprise an output interface 230which is configured to output a control signal for the signal processingcircuit 100. The control signal comprises the alive signal or thetrigger signal that causes the alive signal generator 120 to add thealive signal into the signal path 110.

In some embodiments, the output interface 230 of the ECU 200 isconfigured to output a control signal for the signal processing circuit100, the control signal comprising a reflected alive signal that dependson the added alive signal received by the integrity determinationcircuit 210. Returning the reflected alive signal from the ECU 200 tothe signal processing circuit 100 may enable to also determineinformation on the integrity of the ECU 200. Assuming, as an example,that the added alive signal as received by the integrity determinationcircuit 210 is returned (reflected) as the reflected alive signal, thealive signal generator 120 is capable to conclude that not only thesignal path 110 but also the ECU are working without error if thereflected alive signal is equal to the alive signal added before. Likeconclusions can be drawn if the added alive signal is altered by the ECUbefore being returned as the reflected alive signal, once the deliberatealterations to the added alive signal are known by the signal processingcircuit 100.

FIGS. 1 and 2 illustrate that the alive signal is added to the signalpath 110 at the first position 130 at the very beginning of the signalpath 110, resulting in a high diagnostic coverage of the signal path110. The diagnostic coverage is a quantity indicating how many of thesignal processing components within the signal path are covered, i.e.the number of components that can be assumed to operate without an errorwhen the expected alive signal is received by the integritydetermination circuit 210. Higher diagnostic coverage may result in theassociated device to be classified as having a higher level ofreliability or integrity according to a specific standard or, forexample according to the IEC EN 61508 Standard (Functional safety ofelectrical/electronic/programmable electronic safety related systems),which defines four Safety Integrity Levels (SILs), with SIL 4 being themost dependable and SIL 1 being the least. Automotive applications withhigh diagnostic coverage may, for example, also achieve a higher SILvalue according to the Automotive Safety Integrity Level (ASIL), beingstandardized in ISO 26262. ISO 26262 defines four Safety IntegrityLevels, with ASIL D being the most dependable and ASIL A being theleast.

As further indicated by dashed lines in FIGS. 1 and 2, the alive signalgenerator 120 may also insert the alive signal at other positions 132 aor 132 b within the signal path 110. According to further embodiments,additional alive signals may be added to the signal path at each of thepositions 132 a and 132 b allowing to determine, which of the signalprocessing elements within the signal path is operating erroneously orstuck. For example, the receipt of an expected alive signal for only theadditional alive signals added at position 132 b may allow to conclude,that protocol encoder 116 works without an error while signal processingelement 114 exhibits an error.

According to a further embodiment, the alive signal as added at thefirst position 130 may be altered at third position 132 a (andeventually also at fourth position 132 b) within the signal path 110,the third position 132 a being between the first position 130 and thesecond position 220. If the expected alteration of the alive signal atthe third position 132 a is known, the expected alive signal can becomputed considering the originally-inserted alive signal and thedesired alteration. If the so expected alive signal is received, it canbe concluded that the complete signal path 110 is operating withouterror. If, however, only the originally-inserted alive signal wasreceived, it can be concluded that the signal path is operating,however, with the signal processing element 114 at the third position132 a being stuck so that the alteration of the originally-insertedalive signal does not take place.

If the original alive signal is altered according to a predeterminedalgorithm at every signal processing component within the signal path110, the integrity determination circuit 210 within the ECU 200 iscapable of deriving which of the signal processing components within thesignal path 110 is stuck or inoperable.

In summary, FIGS. 1 and 2 illustrate different ways for the alive signalgenerator 120 to generate an alive signal and where to add it to asignal within the signal path. In the embodiment illustrated in FIG. 1,the alive signal is generated within the signal processing circuit 100,which may, for example, be a sensor subsystem. In the embodimentillustrated in FIG. 2, the ECU 200 influences the generation of thealive signal in an application having a bidirectional interface. Onepossible way of influencing the generation of the alive signal is totrigger the generation of an alive signal within the signal processingcircuit 100. Depending on the interface 150, further to triggering apredetermined alive signal, the ECU 200 may be capable of transmittingthe alive signal to be added to the signal path 110.

For example, for sensor subsystems, unidirectional communication betweena sensor system and an associated ECU may be established using theSingle Edge Nibble Transmission protocol (SENT, SAE J2716). Forbidirectional communication, a Short PWM Code interface (SPC) or aPeripheral Sensor Interface 5 (PSI5) may be used. In both scenarios, thealive signal may be added to the signal at arbitrary positions withinthe signal path 110, which is at or in between arbitrary signalprocessing components within the signal path. For example, if a sensorsystem is monitored, the alive signal may be added directly at thesensor or as an additional input to an analog-to-digital converter usedto digitize the output of the sensor. Further to detect and check thesignal corresponding to the alive signal at the integrity determinationcircuit 210 within the ECU 200 only, the alive signal and/or itsassociated processing may also be checked and controlled by or withineach signal processing component within the signal path, for examplewithin the signal processing element 114 and the protocol encoder 116 ofthe exemplary signal path 110 illustrated in FIGS. 1 and 2.

According to some embodiments, the alive signal is added at the signalsource and further alive signals are added at different signalprocessing components within the signal path 110 to allow identifyingthe signal processing component having an error within the signal path110. For the same purpose, the alive signal may be added or injected tothe signal source and the alive signal may be checked or modified in apredetermined manner at each of the signal processing components withinthe signal path 110 in the signal processing circuit 100. The alivesignal is processed within the protocol encoder 116 to transmit thealive signal or a signal based on the alive signal to the ECU 200. Inimplementations where the alive signal is continuously monitored alongthe individual signal processing components of the signal path 110, thesignal processing circuit 100, e.g. its alive signal generator 120, maybe capable of detecting certain errors or malfunctions of individualsignal processing components itself and transmit an associated messageto the ECU 200, informing the ECU 200 about the occurrence of an errorand eventually also on the signal processing component causing the erroror being stuck.

While FIGS. 1 to 3 have previously been used to describe embodimentsallowing to determine an information of an integrity of signalprocessing components within a signal path 110, FIGS. 4 to 8 illustratesome particular implementations as to how the insertion or adding of thealive signal to a signal within the signal path 110 may be achieved.

Before going into details regarding possible insertion or adding of thealive signal into the signal path 110, some examples for appropriatealive signals are briefly summarized, keeping in mind that the alivesignal can generally be any signal or signal sequence, be it analog ordigital. One possible use of an alive signal may be the adding orinsertion of a toggle bit into the data path. A toggle bit may becharacterized as a quantity that alternatingly has two states. In termsof digital implementations, a first state may be a logical one while asecond state may be a logical zero. Alternate implementations of togglebits may likewise represent the toggle bit as two alternating analogquantities. The alive signal itself may, for example, be implemented asa toggle bit allowing to monitor the change of the toggle bit atpredetermined time intervals so as to be able to conclude that everysignal processing component along the signal path is working properly.According to further examples, the toggle bit may, for example, controlmore complex alive signal generators so as to for example add a furtherelement of an alive signal sequence into the signal path on eachoccurrence of the state change of the toggle bit.

A further example for a possible alive signal is a counting signal as,for example, generated by means of a rolling counter. Similar to thetoggle bit, the value output by the rolling counter may itself representthe alive signal while further embodiments may use the output of therolling counter to control the generation of a more complex alivesignal. The counter's direction may further be controlled to count up ordown in some embodiments.

A further example for an alive signal is a pseudorandom sequence whichmay itself serve as an alive signal having multiple elements which aresubsequently added to the signal path, i.e. to subsequent data framesgenerated within a signal path 110. Further, the pseudorandom sequencemay control the alive signal generation in that the alive signal isdeferred from the values of the pseudorandom sequence.

Further, a predefined signal sequence may be used as an alive signal orto control the alive signal generation. Such a predefined sequence may,for example, be stored in a read-only memory within the signalprocessing circuit 100 and/or the ECU 200. In an alternativeimplementation, the predefined sequence may be defined by the hardwareused and being based on particular hardware characteristics. Accordingto some embodiments, the predefined sequence may be programmable by auser of a signal processing circuit or the associated electric controlcircuit 200, for example, by programing an EEPROM.

FIG. 4 illustrates one particular example as to how an alive signal maybe added into the signal path 110 by changing an operating condition ofa sensor 410 according to the alive signal. While embodiments of signalprocessing circuits may principally be composed of arbitrary signalprocessing components, the following examples of FIGS. 4 to 8 describesignal processing circuits comprising at least one sensor acting as asignal source. In such signal processing circuits, one possible way toadd the alive signal is to change an operating condition of the sensor410 according to the alive signal. The exemplary signal path 110illustrated in FIG. 4 comprises a sensor 410 whose output is connectedto one of multiple inputs of a multiplexer 420, the output of themultiplexer being connected to an analog-to-digital converter 430 todigitize their sensor's output value and the digitized quantity isforwarded to a signal processing element 440 for further processing,such as for example for averaging subsequent sample values of thesensor's output (e.g. for noise suppression). For the simplicity of theillustration, further possible components of the signal path 110 are notillustrated in FIG. 4 while it is to be understood that the signal path110 might comprise multiple more signal processing elements up to theintegrity determination circuit used to evaluate the added alive signaland to determine information of the integrity of the signal path, e.g.whether all its signal processing components operate without an error.

In the particular implementation of FIG. 4, the operating condition ofthe sensor 410 is changed or modified in that a bias or offset value isadded to the sensor output by means of a biasing circuit 450. This mayresult in an analog output provided by the sensor 410 in being modifiedor modulated with the alive signal. This may, for example, be achievedby modifying an operating point or supply voltage of the sensor 410 orby directly adding an analog signal, e.g. a current or a voltage, to thesensor's output. If an alive signal sequence is known, averagingmultiple subsequent sensor readings within the integrity determinationcircuit may achieve both, reconstructing the physical quantitydetermined by the sensor as well as determining the added alive signalsequence. If the added alive signal sequence which is receivedcorresponds to the alive signal sequence added to the signal path bymeans of the offset circuit 450, integrity of the signal path can beassumed. In other words, an additional offset may be added into the datapath which is detected by an analysis block at the end of the data path,while more measurement periods are evaluated and an average ofsubsequent sensor readings is computed to average out individual offsetvalues due to the alive signal.

Based on a similar setup, FIG. 5 illustrates a further possibility ofadding the alive signal into the signal path 110. According to theexample illustrated in FIG. 5, a physical quantity sensed by the sensor410 is altered according to the alive signal. In the particular exampleillustrated in FIG. 5, the sensor 410 is a magnetic field sensor and anamplifier 510 is used to drive a wire-on-chip 512. The wire-on-chip 512generates a magnetic field controlled by the amplifier 510, which is inturn controlled by the alive signal so as to generate sensor readingshaving superimposed or added the alive signal or the alive signalsequence. While FIG. 5 illustrates a magnetic sensor as an example as tohow to achieve the superposition of the alive signal to a physicalquantity sensed by a sensor, other sensor types may use differentmechanisms. For example, temperature sensors may be influenced byheating cells close to the sensor which are controlled by the alivesignal. Likewise, an electrical voltage may influence capacitivesensors, as for example pressure sensors or the like.

FIGS. 6 to 8 illustrate further embodiments in which several sensorreadings are submitted to ECU 200 within a common message framegenerated by a protocol encoder 610 within the signal path 110. To thisend, multiple sensors 620 a, 620 b, . . . may be connected to amultiplexer 630 providing its output to an analog-to-digital converter640 (ADC), which is similar to the architecture of FIGS. 4 and 5.Following the ADC 640, a signal processing element 650 may performfurther signal processing on the digitized sensor readings while theprotocol encoder 610 includes the sensor readings of all sensors into asingle data frame which is subsequently submitted to the ECU 200 viainterface 150. For example, using an SPC interface, sensor data of up tofour sensors may be transmitted from a signal processing or sensorcircuit 100 to an associated ECU 200. In the example illustrated in FIG.6, the alive signal is added to the signal within the signal path 110 ata first position 660 before the multiplexer 630 using adigital-to-analog converter 670. The digital-to-analog converter 670provides an analog output signal according to the alive signal to themultiplexer 630 so as to include the alive signal in the message framegenerated by the protocol encoder 610 within data fields that may alsobe used for the transfer of sensor data. In the particularimplementation of FIG. 6, a counting signal generated by a counter 680is used as an alive signal while further embodiments may likewise addarbitrary other alive signals into the signal path 110 using the sameimplementation.

FIG. 7 illustrates a similar implementation using a bidirectionalcommunication interface 150 between the signal processing circuit 100and the ECU 200 to insert the alive signal at a predetermined positionwithin a message frame generated by the signal processing circuit 100,in particular by its protocol encoder 610. Similar to the embodiment ofFIG. 6, the alive signal is given by the output of a counter 680. Otherthan in FIG. 6, the bidirectional interface 150 is used to send atrigger signal from the ECU 200 to the signal processing circuit 100causing the alive signal generator, which is counter 680 in thisparticular implementation, to add the alive signal in response toreceipt of the trigger signal from the ECU 200. Similar to theimplementation illustrated in FIG. 6, the alive signal, i.e. a digitalvalue representing the output of the counter 680 is added into a datafield of a message frame generated by the protocol encoder 610. The datafield can also be used for sensor data in other implementations relyingon the same architecture. In other words, the data field used for thetransmission of the alive signal is reserved for sensor data accordingto the protocol specification.

FIG. 8 illustrates a further embodiment based on a similar architecture.However, the bi-directional interface 150 between the ECU 200 and thesignal processing circuit 100 is used to directly communicate the alivesignal to be inserted or added to the signal within the signal path 110.To this end, the alive signal generator may be constituted by a receiver810 to receive the alive signal and to forward the alive signal 820 uponits receipt to the digital-to-analog converter 670. The embodimentillustrated in FIG. 8 may allow a user of the system to directlydetermine the alive signal to be used for the generation of theinformation on the integrity of the signal path 110.

FIG. 9 illustrates a further example for adding an alive signal to thesensor signal when a pulse width modulated (PWM) signal is used totransmit the sensor signal. The upper graph 910 illustrates a signalcycle 912 of the PWM protocol used to transfer a sensor signal. The PWMprotocol is a signaling protocol that may be defined or characterized byat least one parameter. A first parameter to characterize the PWMprotocol may be the cycle time between two rising edges, i.e. the timeused for a full signal cycle 912. Alternatively or additionally, asecond parameter to characterize or define the signaling protocol may bethe difference AS (914) between a voltage or a current corresponding tothe high state of the PWM signal and the low state of the PWM signal.Conventional PWM implementations may transmit information by varying theduty cycle of the PWM signal, i.e. the ratio between the times the PWMsignal is high (tH, 916) and low (tL, 918) within a single cycle time.

In a particular simple implementation, a PWM signal as illustrated inthe upper graph 910 of FIG. 9 may be used to transmit the repeatedoccurrence of a particular event by starting a full signal cycle 912 onevery occurrence of the event while maintaining the duty cycle constant,e.g. at the 50% illustrated in the upper graph 910 FIG. 9. An examplefor the use of such a simple and cost efficient implementation is wheelspeed sensors of vehicles, which are used, amongst others, as an inputto antilock braking systems. For every fraction of a full rotation of awheel, a full PWM cycle as illustrated in the upper graph 910 may betransmitted by the wheel speed sensor. Graphs 920, 930 and 940illustrate, how an alive signal may be added without a significantincrease in complexity even to such a comparatively simple signalingprotocol.

The alive signal is added by altering a parameter of the PWM protocolaccording to the alive signal. FIG. 9 illustrates 3 particular examplesfor a PWM signal. Graph 920 illustrates that a variation of the dutycycle of the PWM signal can be used to add the alive signal. Assumingthat the occurrence of a full signal cycle 912 indicates the occurrenceof a particular event (e.g. the rotation by a given angle), deviatingfrom the preconfigured duty cycle as indicated in the secondillustration 920 may be used to add the alive signal or to transmit asingle bit of an alive signal given by a predefined signal sequence. Forexample, the alive signal may be defined as a signal sequence in thatevery nth cycle is transmitted with an altered duty cycle. Further alivesignal sequences may also use unequal spacings for the altered dutycycles.

In further examples, the voltage or current difference AS may be variedto add the alive signal or a signal sequence constituting the alivesignal, as illustrated in graphs 920 and 930. While in graph 930, adecrease of AS is used to add or transmit a bit of the alive signal,graph 940 illustrates that, likewise, an increase of AS can be used forthe same purpose.

While the previous examples have been illustrated for a PWM signal,further examples may likewise alter at least one parameter of othersignaling protocols to add the alive signal in a similar manner whichmay result in a significant increase of the functional safety of theassociated components. This comes without significant additional effortand without significantly increased hardware costs, enabling enhancedfunctional safety ratings also for low complexity and low cost sensors,such as for example for wheel speed sensors.

In summarizing the embodiments of FIGS. 6 to 8, the alive signal isprocessed as a known defined sensor signal to be added into a sequenceof sensor values inside a frame communicated from the signal processingcircuit 100 to the ECU 200. This may be achieved by anydigital-to-analog converter (which can even be a simple voltage divider)which provides the alive signal to be finally transferred as digitaldata in the same data frame besides real sensor signals (for examplefurther to temperature, voltage or other sensor values). After receivingthe transmitted data frame, the converted digital value transmittedwithin a data field of the data frame can be chosen to extract the addedalive signal (bit combination or sequence) at the integritydetermination circuit within the ECU 200.

In particular, FIG. 7 illustrates a receiver-triggered counter 680,which count value is used as the alive signal. The count value selects acertain analog value for the digital-to-analog converter 670 which istransferred within one data frame and can be decoded by the protocolencoder or directly within the integrity determination circuit withinthe ECU 200. FIG. 8 illustrates an embodiment using areceiver-transferred alive signal which value is used as the alivesignal. The alive signal selects a certain analog value for thedigital-to-analog converter 670 which is again transferred within onedata frame and can be decoded by the protocol encoder 610 or by the ECU200. FIG. 6, instead, illustrates a self-generated or triggered alivesignal generator using a counter 680.

FIG. 4 illustrates an embodiment where the alive signal influences thesensor signal via an offset or a bias value. In FIG. 5, the alive signalinfluences the sensor signal by a physical perturbation or by alteringthe physical quantity sensed by the sensor. Using a digital sensorprotocol, as for example one of the protocols SENT, SPC or PSI5, thealive signal may be transmitted or added to a separate data field. Analive signal may be a rolling counter nibble. Also, the alive signal maybe transmitted in a status field of the protocol or, alternatively, becoded into a cyclic redundancy check value of a data frame. To this end,the alive signal generator may be configured to generate a seed valuefor the generation of a cyclic redundancy check (CRC) value of a messageframe. The CRC value is then computed based on a seed value given by thealive signal. At the integrity determination circuit, the CRC value iscomputed using the same seed value, i.e. depending on the alive signal.In the event of a valid CRC value, the integrity determination circuitcould then conclude that all signal processing components within thesignal processing path operate without error.

Similarly, for a receiver triggered or generated signal or alive signal,the alive signal generator and its operation may be triggered by atrigger signal submitted over an interface 150 between the ECU 200 andthe signal processing circuit 100. An alive signal may, for example, bea counter signal, a pseudorandom sequence or a predefined sequence. Insome embodiments, the alive signal may be directly transferred via thebidirectional interface. Particular examples of Protocols fortransferring the alive signal or for triggering the generation of analive signal at the end of the signal processing circuit are the SPCinterface or the PSI5 interface. In the event of the SPC interface, thetrigger pulse may, for example, trigger the alive signal generator. Asan alternative, for example, the alive signal itself may be transferredin the addressed bits and, hence, within an SPC trigger message.According to the SPC protocol, the dedicated length of the trigger pulsemay so be used to trigger the alive signal generator or to directly setthe counter values of the alive signal generator. In the event of thePSI5 interface, the trigger pulse may trigger the action of the alivesignal generator or, similar to the SPC interface, the trigger pulse maydirectly set the alive signal (coded in length).

At the end of the signal path within a receiver or the ECU 200, thealive signal may be decoded so that the complete signal path 110 up intothe ECU 200 would be covered (high diagnostic coverage). Alternatively,the alive signal may be decoded at the end of the signal path within thesignal processing circuit 100, for example within the protocol encoder610 to separately transmit an information on an integrity of the signalpath to the receiver or the ECU 200, for example by means of a statusbit. As previously discussed, the alive signal may also be coded intothe CRC value (e.g. by means of a seed value depending on the alivesignal). The processing and evaluation of the alive signal within theintegrity determination circuit of the ECU may have a data processingdelay and may not necessarily need to be performed synchronously withthe evaluation of the sensor values.

While the previous embodiments have been mainly described for a sensorsystem as an example for a signal processing circuit, furtherembodiments may be implemented in arbitrary applications using signalpaths to subsequently process data or signals by numerous signalprocessing devices.

By using the alive signal performing a logic or arithmetic change ofsignals within the signal path (data path), which is received by the ECUseparately or convoluted in existing data, functional safety can beestablished. When the alive signal is continuously changing (ortoggling) the signal can be used to determine the alive status of thesubsystem (e.g. the sensor system or the signal processing circuit).Other than existing solutions, the alive signal may be fed directly tothe start point of the signal path or the signal processing chain of thesensor subsystem and is continuously processed within the whole datapath or signal path to be demultiplexed at the end of the signal path,where the information on the alive signal is further transmitted withinthe protocol. To this end, an external receiver is able to evaluate theexistence (or the sequence) of the alive signal or of an expected alivesignal generated using the alive signal and can use the transmitted oradded alive signal to judge whether the sensor is processing dataaccordingly or if some of the signal processing components within thesignal path are working erroneously or whether the data path is stuck.To this end, it can be determined if a subsystem is still alive or not.This is important for functional safety applications like, for example,electronic power steering applications. For example, angular sensorsproviding information on the position of the steering wheel in a powersteering application are required to fulfil the highest safetyrequirements as defined by ASIL D. While this may be highly relevant fora sensor system in automotive applications, it is also relevant for allother safety relevant systems providing or requiring that the sensorshall enable to the ECU to detect a malfunction, for example a signalpath being stuck. As compared to alternative approaches where a signalchange is detected to determine information on the integrity of thesignal path, examples described above provide the additional benefitthat the determination of the information of the integrity of the signalpath is also possible if there is no noise altering the signals on thesignal line. Further, the embodiments described herein do not disturbthe data signal itself and the information on the integrity of thesignal path is furthermore meaningful even if the signal generated bythe signal path is constant. As compared to a signal comparison betweentwo redundant sensors measuring the same physical quantity, embodimentsdescribed herein even allow to provide a meaningful information on theintegrity of the signal path if the measured signal of both answers isconstant or changing more slowly than the safety time (the time whereone requires to be sure that the signal path is working properly). Asopposed to methods only directed to the signal interface by including atoggling bit or a changing signal inside a protocol encoder, embodimentsdescribed herein do additionally verify the correctness and the correctupdate of the further components within the signal path, in particularof potentially every signal processing element along the signal path.

The aspects and features mentioned and described together with one ormore of the previously detailed examples and figures, may as well becombined with one or more of the other examples in order to replace alike feature of the other example or in order to additionally introducethe feature to the other example.

Examples may further be or relate to a computer program having a programcode for performing one or more of the above methods, when the computerprogram is executed on a computer or processor. Steps, operations orprocesses of various above-described methods may be performed byprogrammed computers or processors. Examples may also cover programstorage devices such as digital data storage media, which are machine,processor or computer readable and encode machine-executable,processor-executable or computer-executable programs of instructions.The instructions perform or cause performing some or all of the acts ofthe above-described methods. The program storage devices may comprise orbe, for instance, digital memories, magnetic storage media such asmagnetic disks and magnetic tapes, hard drives, or optically readabledigital data storage media. Further examples may also cover computers,processors or control units programmed to perform the acts of theabove-described methods or (field) programmable logic arrays ((F)PLAs)or (field) programmable gate arrays ((F)PGAs), programmed to perform theacts of the above-described methods.

The description and drawings merely illustrate the principles of thedisclosure. Furthermore, all examples recited herein are principallyintended expressly to be only for pedagogical purposes to aid the readerin understanding the principles of the disclosure and the conceptscontributed by the inventor(s) to furthering the art. All statementsherein reciting principles, aspects, and examples of the disclosure, aswell as specific examples thereof, are intended to encompass equivalentsthereof.

A functional block denoted as “means for . . . ” performing a certainfunction may refer to a circuit that is configured to perform a certainfunction. Hence, a “means for s.th.” may be implemented as a “meansconfigured to or suited for s.th.”, such as a device or a circuitconfigured to or suited for the respective task.

Functions of various elements shown in the figures, including anyfunctional blocks labeled as “means”, “means for providing a sensorsignal”, “means for generating a transmit signal.”, etc., may beimplemented in the form of dedicated hardware, such as “a signalprovider”, “a signal processing unit”, “a processor”, “a controller”,etc. as well as hardware capable of executing software in associationwith appropriate software. When provided by a processor, the functionsmay be provided by a single dedicated processor, by a single sharedprocessor, or by a plurality of individual processors, some of which orall of which may be shared. However, the term “processor” or“controller” is by far not limited to hardware exclusively capable ofexecuting software, but may include digital signal processor (DSP)hardware, network processor, application specific integrated circuit(ASIC), field programmable gate array (FPGA), read only memory (ROM) forstoring software, random access memory (RAM), and nonvolatile storage.Other hardware, conventional and/or custom, may also be included.

A block diagram may, for instance, illustrate a high-level circuitdiagram implementing the principles of the disclosure. Similarly, a flowchart, a flow diagram, a state transition diagram, a pseudo code, andthe like may represent various processes, operations or steps, whichmay, for instance, be substantially represented in computer readablemedium and so executed by a computer or processor, whether or not suchcomputer or processor is explicitly shown. Methods disclosed in thespecification or in the claims may be implemented by a device havingmeans for performing each of the respective acts of these methods.

It is to be understood that the disclosure of multiple acts, processes,operations, steps or functions disclosed in the specification or claimsmay not be construed as to be within the specific order, unlessexplicitly or implicitly stated otherwise, for instance for technicalreasons. Therefore, the disclosure of multiple acts or functions willnot limit these to a particular order unless such acts or functions arenot interchangeable for technical reasons. Furthermore, in some examplesa single act, function, process, operation or step may include or may bebroken into multiple sub-acts, -functions, -processes, -operations or-steps, respectively. Such sub acts may be included and part of thedisclosure of this single act unless explicitly excluded.

Furthermore, the following claims are hereby incorporated into thedetailed description, where each claim may stand on its own as aseparate example. While each claim may stand on its own as a separateexample, it is to be noted that—although a dependent claim may refer inthe claims to a specific combination with one or more other claims—otherexamples may also include a combination of the dependent claim with thesubject matter of each other dependent or independent claim. Suchcombinations are explicitly proposed herein unless it is stated that aspecific combination is not intended. Furthermore, it is intended toinclude also features of a claim to any other independent claim even ifthis claim is not directly made dependent to the independent claim.

1. A method for determining information on an integrity of at least onesignal processing component within a signal path, comprising: adding analive signal to a signal at a first position within the signal path;detecting a signal corresponding to the added alive signal at a secondposition within the signal path; and determining the information on theintegrity based on the detected signal.
 2. The method of claim 1,wherein adding the alive signal comprises: changing an operatingcondition of a sensor according to the alive signal.
 3. The method ofclaim 1, further comprising: altering the alive signal using a signalprocessing element at a third position within the signal path, the thirdposition being between the first position and the second position. 4.The method of claim 1, wherein the first position is located within asensor configured to sense a physical quantity; and wherein the secondposition is located within an electric control unit configured toreceive sensor data of the sensor.
 5. The method of claim 1, furthercomprising: receiving a trigger pulse; and adding the alive signal basedon receiving the trigger pulse.
 6. The method of claim 1, furthercomprising: providing a reflected alive signal depending on the addedalive signal from the second position to the first position.
 7. A signalprocessing circuit having a signal path for processing a sensor signal,the signal processing circuit comprising: an alive signal generatorconfigured to add an alive signal to the sensor signal at a firstposition within the signal path.
 8. The signal processing circuit ofclaim 7, wherein the alive signal generator is configured to change anoperating condition of a sensor according to the alive signal.
 9. Thesignal processing circuit of claim 8, wherein the alive signal generatoris configured to alter a physical quantity sensed by the sensor.
 10. Thesignal processing circuit of claim 8, wherein the alive signal generatoris configured to add an offset to a sensor signal generated by thesensor.
 11. The signal processing circuit of claim 7, wherein the alivesignal generator is configured to alter a parameter of a signalingprotocol used to transmit the sensor signal according to the alivesignal.
 12. The signal processing circuit of claim 7, wherein the alivesignal generator is configured to insert the alive signal at apredetermined position within a message frame generated by the signalprocessing circuit.
 13. The signal processing circuit of claim 12,wherein the alive signal generator is configured to insert the alivesignal into a data field of the message frame which is reserved forsensor data.
 14. The signal processing circuit of claim 7, wherein thealive signal generator is configured to generate a seed value forgeneration of a cyclic redundancy check value of a message frame basedon the alive signal.
 15. The signal processing circuit of claim 7,wherein the alive signal generator further comprises: a signal inputconfigured to receive a trigger signal, wherein the alive signalgenerator is configured to add the alive signal based on receiving thetrigger signal.
 16. The signal processing circuit of claim 15, whereinthe alive signal generator is configured to add the received triggersignal as the alive signal.
 17. The signal processing circuit of claim7, further comprising: a signal source configured to provide the sensorsignal; at least one signal processing component configured to processthe sensor signal; and a protocol encoder configured to generate amessage frame based on the sensor signal; wherein the signal source, theat least one signal processing component, the protocol encoder, and thealive signal generator are monolithically integrated.
 18. An ElectricControl Unit for receiving signals from a signal processing circuit, theElectric Control Unit comprising: an integrity determination circuitconfigured to receive an added alive signal and to determine informationon an integrity of at least one signal processing component within thesignal processing circuit based on a comparison of the added alivesignal and an expected alive signal.
 19. The Electric Control Unit ofclaim 18, further comprising: an output interface configured to output acontrol signal for the signal processing circuit, the control signalcomprising an alive signal or a trigger signal causing the signalprocessing circuit to add the alive signal.
 20. The Electric ControlUnit of claim 18, further comprising: an output interface configured tooutput a control signal for the signal processing circuit, the controlsignal comprising a reflected alive signal depending on the added alivesignal.